1527571 - giving cloudops scopes for mozilla-releng/product-details repository secrets/roles

Status: RESOLVED FIXED

(Taskcluster :: Operations and Service Requests, task)

Description

[Rok Garbas [:garbas]]

Please give mozilla-group:team_services_ops the following scopes:

• assume:repo:github.com/mozilla-releng/product-details*
• auth:create-role:repo:github.com/mozilla-releng/product-details*
• auth:delete-role:repo:github.com/mozilla-releng/product-details*
• auth:update-role:repo:github.com/mozilla-releng/product-details*
• secrets:get:repo:github.com/mozilla-releng/product-details*
• secrets:set:repo:github.com/mozilla-releng/product-details*

Thank you.

Comment 1

[Tom Prince [:tomprince]]

Are all those scopes required, or are the secrets:* scopes there enough?

It isn't clear to me how the first four scopes are going to be used.

Comment 2

[Rok Garbas [:garbas]]

:tomprince above scopes would allow cloudops to create roles with scopes over different branch (testing/staging/production).

Comment 3

[Tom Prince [:tomprince]]

We have been moving to maanging roles via ci-config and ci-admin, which is soon going have support for github repos.

Given that, I'd rather not hand out scopes for managing those roles manually. Given that' I'll go ahead and grant access to just the secrets for the moment. We can revisit this later, if more turn out to be necessary.

Comment 4

[Tom Prince [:tomprince]]

Attachment: Bug 1527571: Grant cloudops the ability to manage product-details secrets; r?rail

Comment 5

[Tom Prince [:tomprince]]

https://hg.mozilla.org/ci/ci-configuration/rev/20d6c4afa77c